topic Re: Create email alert when a particular string/keyword is found in log event in Alerting

Create email alert when a particular string/keyword is found in log event

navd — Thu, 14 Jun 2018 19:17:31 GMT

I am having couple of string to look for in log events and generate an alert when the matching string/keyword appears

Following are example keywords:-
ERROR - [] - Failed to create custom account for user
Code: Internal Server Error; Exception:
Internal Server Error; Exception: com.google.search.ts.exception:

So my current search look like this , but I want to know if there is any other way creating alert based on the string/keywords

index="abc" "ERROR - [] - Failed to create custom account for user" OR "Code: Internal Server Error; Exception: " OR "Internal Server Error; Exception: com.google.search.ts.exception: "

Re: Create email alert when a particular string/keyword is found in log event

richgalloway — Fri, 15 Jun 2018 02:45:32 GMT

I would do it the same way.

Re: Create email alert when a particular string/keyword is found in log event

amiftah — Fri, 15 Jun 2018 04:15:40 GMT

I see all the strings contain "error" so maybe if you just save this search : index="abc" error as alert and choose send email as action will do the job..

Re: Create email alert when a particular string/keyword is found in log event

navd — Fri, 15 Jun 2018 14:57:21 GMT

But , when I recieve the Email alert is it possible to include only the string that triggered(out of 4 other strings I am having) instead of displaying entire search string in email alert ?

Re: Create email alert when a particular string/keyword is found in log event

amiftah — Fri, 15 Jun 2018 17:08:33 GMT

Yes, In that case, you should extract the 4 strings in a field, and when you trigger the alert, send your field in your email: $result.yourfield$ , and include this field in the search: index=foo error | table yourfield